CVE-2026-78991 in Chrome
Summary
by MITRE • 08/26/2026
Race condition in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as CVE-2024-8391 represents a significant race condition within the WebProtect component of Google Chrome, specifically affecting versions prior to 152.0.7977.65. This flaw is categorized under CWE-362, which describes concurrent execution access with insufficient synchronization. The core technical issue arises from a timing window where multiple operations interact without proper locking mechanisms or atomic checks. In the context of Chrome's architecture, this occurs within the renderer process, which is responsible for executing web content such as HTML and JavaScript in an isolated sandbox environment. While these sandboxes are designed to prevent arbitrary code execution on the host system, they do not inherently protect against logic errors that allow one compromised component to manipulate shared state or resources faster than security checks can validate them.
The operational impact of this vulnerability is contingent upon a specific prerequisite: the attacker must already have achieved compromise of the renderer process through another vector, such as exploiting a separate memory corruption bug or injecting malicious code via a crafted HTML page. Once inside the renderer, an adversary can exploit the race condition in WebProtect to bypass security controls that are intended to restrict access to sensitive information. By carefully crafting requests and timing them precisely against Chrome's internal state transitions, the attacker can trick the browser into revealing data it would otherwise withhold. This could include session tokens, authentication cookies, or other credentials stored within the scope of the compromised renderer context. The Chromium security team has classified this issue with a medium severity rating, reflecting its dependency on prior compromise and the complexity required to successfully exploit the race condition in a real-world scenario.
From an industry standards perspective, this vulnerability aligns closely with MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter sub-techniques that leverage browser capabilities for further exploitation. It also relates to privilege escalation within the sandboxed environment, moving from restricted renderer access toward broader data exfiltration. The lack of proper synchronization in WebProtect highlights a common challenge in complex software systems where performance optimizations sometimes inadvertently reduce security rigor by skipping redundant checks under high-load or concurrent conditions. This type of flaw is particularly dangerous because it undermines the trust model that relies on strict isolation between different parts of the browser engine, allowing lateral movement within the application's own boundaries even if external system access remains blocked.
Mitigation for this vulnerability primarily involves updating Google Chrome to version 152.0.7977.65 or later, where the race condition has been resolved through improved synchronization primitives and stricter validation of state transitions in WebProtect. For organizations unable to patch immediately, implementing strict Content Security Policy headers can help mitigate some risks by limiting the types of scripts that execute within renderers, thereby reducing the attack surface for initial renderer compromise. Additionally, enabling Chrome's built-in sandboxing features ensures that even if a renderer is compromised, the blast radius remains contained. Regular security audits focusing on concurrency issues in critical path components like WebProtect are recommended to prevent similar race conditions from being introduced during future development cycles.